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I. Real Party in Interest 

The real party in interest in this appeal is Inmon Corporation, a corporation 
organized under the laws of California. 

II. Related Appeals and Interferences 

There are no appeals or interferences that will directly affect, or be directly 
affected by, or have a bearing on the Board's decision in this appeal. 

III. Status of Claims 

This application includes claims 1-32. Of these, claims 20-25 have been 
cancelled, leaving claims 1-19 and 26-32 pending. All pending claims stand rejected, 
leaving no claims allowed. The claims on appeal are claims 1-19 and 26-32. 

IV. Status of Amendments 

All amendments have been entered. 

V. Summary of Claimed Subject Matter 
Claim 1 recites: 

A method for monitoring a network, comprising: 

receiving data packet flow records from at least one network router; 

filtering said flow records; 

extracting packet information from said filtered flow records, wherein said extracted 
packet information comprises information of at least one target of interest; and 

performing active measurements of said at least one target of interest based on 
said extracted packet information. 
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Claim 10 recites: 

A network monitoring apparatus, comprising: 

a monitor configured for receiving data packet flow records from at least one 
network router, for filtering said flow records, for extracting packet information from said 
filtered flow records, said extracted packet information comprising information of at least 
one target of interest, and for performing active measurements of said target of interest 
based on said extracted packet information. 

Claim 19 recites: 

A method for monitoring a network, comprising: 

receiving data packet flow records from at least one network router; 

extracting packet information from at least a fraction of said received flow records, 

wherein said extracted packet information comprises information of at least one target of 

interest; and 

performing active measurements of said at least one target of interest based on 
said extracted packet information. 

As described in the specification, the embodiment according to the present 
application lends itself well to use in a data network wherein it is desired to monitor the 
active data throughput of the network, e.g., quality of service, such as delay and 
response time. As explained in the background of the present application, there were 
previously two ways to monitor the active data throughput of a data network. 
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The first way of monitoring the active data throughput involves emulating traffic 
on the network, whereby simulated traffic is sent to and from a remote target host site 
and measured in order to quantify the data throughput of the network (see page 2, lines 
12-22). There are, however, several problems with this approach. First, there are 
millions of hosts on the Internet, and therefore selecting a set of host sites to test is a 
difficult problem. Second, during high network loads, the additional traffic imposed on 
the network for active monitoring can drastically reduce throughput to and from the 
remote host sites, resulting in inaccuracies in the throughput measurements (see page 
2, line 23 to page 3, line 7). 

The second way of monitoring the active data throughput is by positioning 
probes at selected monitoring points along the network and measuring the round-trip 
delay of the actual data that is transmitted through the network based on time-stamps 
taken by the probes (see page 3, lines 8-21). Although this approach is less intrusive 
than the first, it requires the placing of probes at each monitoring site, still requires 
some additional transmission of monitoring data, and does not take into account time- 
out delays (see page 3, line 22 to page 4, line 10). 

The embodiment according to the present application solves the afore-described 
problems by emulating traffic on the network in a similar manner as the first active data 
throughput monitoring method, but basing the emulated traffic on passive 
measurements taken within the network in order to more focus the transmission of the 
simulated data to the most pertinent remote host sites. In particular, the passive 
measurements are obtained by receiving data packet flow records from at least one 
network router, filtering the flow records, and extracting information of at least one target 
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of interest from the filtered flow records. Active measurements, such as pinging or 
tracerouting, are then performed on the target(s) of interest based on- the extracted 
information. In this manner, a more focused and efficient means of measuring the active 
throughput of a network can be achieved. 

Examples of a method that includes the steps of claims 1 and 19, and examples 
of a network monitoring apparatus that includes the elements of claim 1 0, can be found at 
least from page 7, line 2, to page 1 1 , line 5, and figures 3 and 4 of the application. 

In particular, with respect to claims 1,10, and 1 9, see page 9, lines 22-23, 
describing an embodiment of a monitor for receiving data packet flow records from a 
router, page 9, line 25 to page 10, line 1, describing an embodiment of filtering flow 
records, page 10, lines 3-4, describing an embodiment of extracting packet information 
from filtered flow records, wherein extracted packet information comprises information 
of the target of interest; and page 10, lines 6-10, describing an embodiment of 
performing active measurements of a target of interest. 

Also, with respect to claim 10, figure 3 illustrates the basic embodiment of a 
network monitoring system 300, which generally comprises a main server 310, a router 
340 coupled between the server 310 and the Internet 350, and a network monitor 330 
coupled to the router 340. The monitor 330 filters data packets transmitted between 
the server 310 and Internet 350 and generates and transmits flow records containing 
destination and source information of each data packet to the monitor 330. The 
monitor 330 selects a fraction of the flow records, extracts the destination and source 
information from the selected flow records. The router 340 than performs active 
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network tests, such as pinging and tracerouting, on remote hosts 340 based on the 
extracted destination and source information. 

VI. Grounds of Rejection to be reviewed on Appeal 

Whether claims 1-19 and 26-32 are unpatentable under 35 U.S.C. §10.3 as being 
obvious over U.S. Patent No. 6,308,148 ("Bruins") in view of U.S. Patent No. 6,587,878 
("Merriam") 

VII. Grouping of Claims 

Claims 1-19 and 26-32 stand and fall together. 

VIII. Arguments 

Appellant respectfully submits that the Examiner erred in rejecting claims 1-19 
and 26-32 under 35 U.S.C. §103 as being obvious over Bruins in view of Merriam, since 
neither of these references, alone or in combination, disclose, teach or suggest the 
combination of elements required by these claims. 

As made clear by Bruins and Merriam, there are generally two architectures used 
to measure network traffic: passive and active traffic measurements. Passive traffic 
measurements have a low impact on a network and are relatively inexpensive to make, 
but only provide traffic accounting— not quality of service information (delay and 
response time) (see background of Bruins). Active traffic measurements do provide 
quality of service information, but are expensive and intrusive (see background of 
Merriam, and background of specification). 

Prior to Appellant's invention, companies tended to focus on one or the other of 
these measurement strategies — passive measurements for traffic accounting, and 
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active measurements for quality of service monitoring. In contrast to these separate 
approaches, Appellant has invented a hybrid approach that combines the strengths of 
these approaches. That is, passive measurements are used to provide an inexpensive 
overview of traffic on the network and allow high value targets to be automatically 
selected, so that the maximum benefit (in terms of profiling the performance that most 
active users see) is derived for the smallest number of active tests. Additionally, the 
cost/time typically involved in configuring an active monitoring system is significantly 
reduced, since the targets are now automatically selected. 

Despite the Examiner's latest clarification of the suggestion to combine the 
teachings of Bruins and Merriam in the Final Office Action, dated January 10, 2005, 
Appellant respectfully submits that such combination is still improper. In particular, in 
attempting to link the two references, the Examiner has pointed to basic commonalities 
between the references that can be found in any network where it is desirable to 
perform traffic measurements. However, more than that is required to combine the 
teachings of the references. 

For example, the Examiner points to the statement in the Abstract of Bruins that 
the system disclosed therein can be used to adjust features or parameters of the 
network (see Final Office Action, page 3, lines 1 1-13). Appellant does not disagree that 
one of the purposes of both systems described in Bruins and Merriam is to adjust the 
features or parameters of the network— indeed, it is the reason why networks are 
tested, either through passive measurements or active measurements. Appellant, 
however, does not agree that a terse statement merely stating that passive 
measurements can be used to improve the features or parameters of a network 
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somehow suggests to one of ordinary skill in the art that active measurements of a 
target of interest can be performed based on packet information extracted from passive 
measurements. Again, it only states the obvious — that it is desirable to improve the 
operation of networks — and suggests nothing else. Appellant would venture to say that 
if a suggestion to combine references could be based on a general statement that it 
would be nice to improve the features and parameters of a system, then otherwise valid 
innovations on data networks, or any other system for that matter, could not be 
patented, since it is always desirable to improve the features and parameters of a 
network or system. 

At most, this statement suggests that the features and parameters of a network, 
such as that disclosed in Bruins, can be improved by performing active measurements. 
The question remains, how? The only answer found in these references is by 
performing the active measurements in the exact same manner described in Merriam. 
There is no suggestion that the passive and active measurement aspects of the 
systems of Bruins and Merriam be combined, and certainly no suggestion to combine 
these aspects in the manner required by the claimed invention. At most, there is only a 
suggestion that passive and active measurements can be performed independently of 
each other to perform different traffic measurements to improve different parameters 
and features of a network. 

As another example, the Examiner states that Bruins collects flow data related to 
web and http services, and Merriam performs active tests on network devices hosting 
web and http services (see Final Office Action, page 8, lines 6-16). Again, these are 
common attributes that are addressed by any traffic measurement system, and is a far 
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cry from suggesting to one of ordinary skill in the art that active measurements of a 
target of interest can be performed based on packet information extracted from passive 
measurements. Again, at most, Bruins and Merriam suggest that the hosting web and 
http services disclosed in Bruins can be improved by performing active measurements, 
but does not suggest how such improvements would be made other than performing 
the active measurements in the exact same manner described in Merriam — not in the 
manner required by the claimed invention. 

Thus, rather than pointing to passages in these references that truly suggest that 
the Bruins system should be modified to include an active measurement system that 
uses the passive measurements to focus the active measurements on targets— or at 
the least, passages that suggest combining the aspects of active and passive 
measurement systems in any integrated manner, the Examiner points to obvious 
features common to all data networks (i.e., that it would be desirable to improve the 
network parameters and features or to improve website and http services) in an attempt 
to link the two references in the manner taught by the application. 

Appellant reiterates that a suggestion to combine the references in the manner 
set forth by the Examiner can only come from the detailed description of the instant 
specification, which the Examiner cannot use. Instead of looking to the prior art and 
working forwards from there in attempting to determine whether the combination of 
Bruins and Merriam is proper, the Examiner has improperly worked backwards from the 
claims. For example, the prior art problem addressed by Appellant was the increased 
expense and intrusiveness of active measurement systems. This problem is certainly 
not addressed by Bruins, which discloses a passive measurement system for improving , 
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the features and parameters of a network as all passive measurement systems 
ultimately do, and is not addressed anywhere in Merriam, which attempts to more 
accurately determine delays in a network. In contrast, Appellant has addressed this 
problem by focusing the active measurements on the targets where network traffic is 
most likely to be found. Appellant has specifically accomplished this by passively 
measuring network traffic to determine the most likely targets. This, the Examiner 
cannot use in the obviousness analysis. 

Appellant is aware that a suggestion to combine references need not relate to 
the same problem addressed by an Appellant, but can also relate to problems 
addressed by the prior art as well. However, there is no suggestion to combine the 
references to solve the problems disclosed therein either. Being that the teachings of 
Memam are being used by the Examiner to modify the system of Bruins, the problem 
solved by Merriam would be relevant. In particular, as previously stated, Merriam is 
concerned with a means for more accurately quantifying the delays in a network, 
supposedly so that the network can be improved. The most that this suggests is that 
an active measurement means can be incorporated into the Bruins system to address 
this problem. Thus, not only does Bruins and Merriam fail to suggest the claimed 
invention for the purpose of focusing active measurements on targets to decrease the 
expense and intrusiveness of the system, Bruins and Merriam fail to suggest the 
claimed invention for any other purpose. 

In the Advisory Action, dated March 29, 2005, the Examiner stated he "is not just 
stating that the suggestion or motivation to combine is to improve the efficiency of the 
network, but the Examiner also pointed out that the suggestion or motivation to 
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combine Bruins' method of extracting packet information from the filtered flow records 
with Marriam's performance measurement program to measure actual performance 
data extracted from the filter is in the Abstract of Bruins." However, the Examiner 
pointed to no suggestion other than that one of ordinary skill in the art would be 
motivated based on the statement by Bruins that it is desirable to improve the efficiency 
of the network. The Examiner appears to conclude that the teaching of "Bruins' method 
of extracting packet information from the filtered flow records with Marriam's 
performance measurement program" is some sort of suggestion in itself. However, this 
is not a suggestion, but rather an improper conclusion based on the mere suggestion 
that it is desirable to improve the efficiency of the network. That is, if a first prior art 
reference teaches the elements A, B, and C, and a second prior art reference teaches 
element D, there must be some suggestion in the prior art to make the combination 
ABCD. However, none of the elements A, B, C, or D is a suggestion itself. 

In the Advisory Action, the Examiner further stated that "[a]fter reading [Bruins], 
one of ordinary skill in the art would recognize that when adjusting the network 
performance parameters of the network, one would try to improve its efficiency in terms 
of performance, and not try to degrade its performance nor adjusting the performance 
parameters just for the sake of adjusting." Appellant does not disagree. However, the 
notoriously well-known fact that one would want to improve the efficiency of a network 
and not degrade it is insufficient to make the prior art combination made by the 
Examiner, as discussed above. 

The Examiner further states in the Advisory Action that he "is not just merely 
stating the obvious suggestion or motivation to combine, but also pointed out in the 
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prior art which emphatically and clearly states it." Appellant does not disagree that the 
prior art emphatically states that one would want to improve the performance of a 
network. Appellants point is that the Examiner's statement that it is desirable to 
improve the efficiency of networks states the obvious — not that it is obvious (clearly, it is 
true), and that such a finding cannot be used as a panacea for combining references 
each time such combination results in a more efficient system. 

Thus, Appellant respectfully believes that independent claims 1-19 and 26-32 



are patentable over the combination of Bruins and Marriam. 



Respectfully submitted, 
Bingham McCutchen LLP 



Dated: December 1 3> , 2006 




Gerald Chan 
Reg. No. 51,541 



Bingham McCutchen LLP 
Three Embarcadero Center 
San Francisco, California 94111 
(650) 849-4960 
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IX. Appendix of Claims Involved in the Appeal 

1. A method for monitoring a network, comprising: 

receiving data packet flow records from at least one network router; 
filtering said flow records; 

extracting packet information from said filtered flow records, wherein said extracted 
packet information comprises information of at least one target of interest; and 

performing active measurements of said at least one target of interest based on 
said extracted packet information. 

2. The method according to claim 1, said filtering comprising selecting flow 
records based on packet routing information in said received flow records. 

3. The method according to claim 2, said filtering comprising selecting flow 
records having non-local destination or source addresses. 

4. The method according to claim 2, said filtering comprising selecting flow 
records having local destination or source addresses. 

5. The method according to claim 2, said filtering comprising selecting flow 
records having destination or source addresses associated with performing critical 
services. 

6. The method according to claim 1, said filtering comprising randomly selecting 
flow records from said received flow records. 

7. The method according to claim 1 , wherein said performance of active 
measurements comprises a ping process. 
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8. The method according to claim 1 , wherein said performance of active 
measurements comprises a traceroute process. 

9. The method according to claim 1 , further comprising selecting the nature of 
said active measurements based on said at least one target of interest. 

10. A network monitoring apparatus, comprising: 

a monitor configured for receiving data packet flow records from at least one 
network router, for filtering said flow records, for extracting packet information from said 
filtered flow records, said extracted packet information comprising information of at least 
one target of interest, and for performing active measurements of said target of interest 
based on said extracted packet information. 

1 1 . The apparatus according to claim 10, wherein said monitor is configured to 
filter said flow records based on packet routing information in said flow records. 

12. The apparatus according to claim 1 1 , wherein said monitor is configured for 
selecting flow records having non-local destination or source addresses. 

13. The apparatus according to claim 11, wherein said monitor is configured for 
selecting flow records having local destination or source addresses. 

14. The apparatus according to claim 1 1 , wherein said monitor is configured for 
selecting flow records having destination or source addresses associated with performing 
critical services. 

15. The apparatus according to claim 10, wherein said monitor is configured for 
randomly selecting flow records from said received flow records. 
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16. The apparatus according to claim 10, wherein said performance of active 
measurements comprises a ping process 

17. The apparatus according to claim 10, wherein said performance of active 
measurements comprises a traceroute process. 

18. The apparatus according to claim 10, wherein said monitor is configured for 
selecting the nature of said active measurements based on said at least one target of 
interest. 

19. A method for monitoring a network, comprising: 

receiving data packet flow records from at least one network router; 

extracting packet information from at least a fraction of said received flow records, 
wherein said extracted packet information comprises information of at least one target of 
interest; and 

performing active measurements of said at least one target of interest based on 
said extracted packet information. 

26. The method according to claim 19, wherein said performance of active 
measurements comprises a ping process. 

27. The method according to claim 19, wherein said performance of active 
measurements comprises a traceroute process. 

28. A network monitoring apparatus, comprising a monitor configured for 
performing the method of claim 19. 

29. The method of claim 1, further comprising: 
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routing said data packets through said at least one router; and 
generating said data packet flow'records. 

30. The apparatus of claim 10, further comprising said at least one router 
configured for routing said data packets and generating said data packet flow records. 

31 . The method of claim 1 9, further comprising: 

routing said data packets through said at least one router; and 
generating said data packet flow records. 

32. The apparatus of claim 28, further comprising said at least one router 
configured for routing said data packets and generating said data packet flow records. 
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RELATED PROCEEDING APPENDIX 



None 
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